Version 5.1: Security Update, Classic Remote Control is back, more...

Shairport Sync 5.1

This update contains a security fix, new features and bug fixes and is recommended for all users.

Stuff You Should Not Ignore

Security Fix

• Fixed Out-Of-Bounds reads and a potential infinite loop in TLV and DMAP parsers. Thanks to TristanInSec for two reports and the PR to fix it.
• New ./configure flags. The metadata pipe and multicast interfaces are no longer included automatically when metadata support is included in the build configuration. To include them, use the respective new configuration flags listed below:
  • —with-metadata-pipe
  • —with-metadata-multicast.

Remote Control is Back for Classic AirPlay!

An error that broke DACP signalling has been fixed. Messages (e.g. “play”, “pause”, “next”, etc.) sent to Shairport Sync via the D-Bus, MPRIS or MQTT interfaces are now correctly forwarded to the client. This works for classic AirPlay only.

New Features

• AirPlay 2 Password: You can now set a password for AirPlay 2 as well as classic AirPlay.
  Until now, you could only set a password on a classic AirPlay service. Now it works on AirPlay 2 connections too.
• Up to 31 channels now allowed on the output device.
  The previous limit was eight channels; if you connected to a device with more than eight channels, Shairport Sync was unable to use it.
• The AirPlay 2 build can now provide a pure classic AirPlay mode either by request or by default under the control of a new optional setting:
  • You can ask the AirPlay 2 build of Shairport Sync to provide a purely classic AirPlay service with a setting: --service-type=<type> on the command line, or service_type = "<type>"in the general section of the configuration file. The <type> can be "auto" (default), "classic" or "airplay2".
  • If the service type setting is omitted or set to "auto", AirPlay 2 service will be provided if NQPTP is running, and classic AirPlay service will be provided if not.

More…

• Improved stability when switching players.
  • When an existing session is interrupted, it is completely terminated before starting the new session.
• Updated Docker base Linux image and FFmpeg libraries
  • Alpine 3.23.4 and FFmpeg 8.1.
• Docker image generation for ARM V6 CPUs has been discontinued.
  • Docker itself is no longer supported on ARM V6 CPUs.
• Updated sample docker-compose.yml to ask for SYS_NICE capabilities.
• Miscellaneous Bug Fixes
  • Fixed incorrect signalling of the DACP port to the DACP monitor. The dapo metadata, giving the DACP port number, is now sent as text, with a token of ”0” when the port becomes inaccessible.
  • When an immediate flush is requested, PTP clock information is reset immediately to disable the use an out-of-date clock until play is resumed.
  • If a TEARDOWN has a plist with a streams item, the player is stopped. If the plist exists but is empty, the connection is closed immediately rather than waiting for the connection to be closed by the client.
  • Set Locales in Test Clients
    • This allows the shairport-sync-dbus-test-client and shairport-sync-mpris-test-client apps to display non-ASCII characters correctly.
  • Fix a stack overflow bug on Alpine Linux with log verbosity set to -vvv. Thanks to Arthur Loureiro for the report.
  • Display n/a is a statistics readout instead of the value of UINT64_MAX — 18446744073709551615 — if the minimum DAC length is not available.
• User Service Installer Script Update
  • Checks are now included for non-root use and for PipeWire or PulseAudio services.
• Dependabot updates.